-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Web Server 3.1 Service Pack 10 security update
Advisory ID:       RHSA-2020:3303-01
Product:           Red Hat JBoss Web Server
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:3303
Issue date:        2020-08-04
CVE Names:         CVE-2020-1935 CVE-2020-13935 
====================================================================
1. Summary:

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and
RHEL 7.

Red Hat Product Security has rated this release as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat JBoss Web Server 3.1 for RHEL 6 - noarch
Red Hat JBoss Web Server 3.1 for RHEL 7 - noarch

3. Description:

Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.

This release of Red Hat JBoss Web Server 3.1 Service Pack 10 serves as a
replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which
are documented in the Release Notes document linked to in the References.

Security Fix(es):

* tomcat: multiple requests with invalid payload length in a WebSocket
frame could lead to DoS (CVE-2020-13935)
* tomcat: Mishandling of Transfer-Encoding header allows for HTTP request
smuggling (CVE-2020-1935)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1806835 - CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling
1857024 - CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS

6. Package List:

Red Hat JBoss Web Server 3.1 for RHEL 6:

Source:
tomcat7-7.0.70-41.ep7.el6.src.rpm
tomcat8-8.0.36-45.ep7.el6.src.rpm

noarch:
tomcat7-7.0.70-41.ep7.el6.noarch.rpm
tomcat7-admin-webapps-7.0.70-41.ep7.el6.noarch.rpm
tomcat7-docs-webapp-7.0.70-41.ep7.el6.noarch.rpm
tomcat7-el-2.2-api-7.0.70-41.ep7.el6.noarch.rpm
tomcat7-javadoc-7.0.70-41.ep7.el6.noarch.rpm
tomcat7-jsp-2.2-api-7.0.70-41.ep7.el6.noarch.rpm
tomcat7-jsvc-7.0.70-41.ep7.el6.noarch.rpm
tomcat7-lib-7.0.70-41.ep7.el6.noarch.rpm
tomcat7-log4j-7.0.70-41.ep7.el6.noarch.rpm
tomcat7-selinux-7.0.70-41.ep7.el6.noarch.rpm
tomcat7-servlet-3.0-api-7.0.70-41.ep7.el6.noarch.rpm
tomcat7-webapps-7.0.70-41.ep7.el6.noarch.rpm
tomcat8-8.0.36-45.ep7.el6.noarch.rpm
tomcat8-admin-webapps-8.0.36-45.ep7.el6.noarch.rpm
tomcat8-docs-webapp-8.0.36-45.ep7.el6.noarch.rpm
tomcat8-el-2.2-api-8.0.36-45.ep7.el6.noarch.rpm
tomcat8-javadoc-8.0.36-45.ep7.el6.noarch.rpm
tomcat8-jsp-2.3-api-8.0.36-45.ep7.el6.noarch.rpm
tomcat8-jsvc-8.0.36-45.ep7.el6.noarch.rpm
tomcat8-lib-8.0.36-45.ep7.el6.noarch.rpm
tomcat8-log4j-8.0.36-45.ep7.el6.noarch.rpm
tomcat8-selinux-8.0.36-45.ep7.el6.noarch.rpm
tomcat8-servlet-3.1-api-8.0.36-45.ep7.el6.noarch.rpm
tomcat8-webapps-8.0.36-45.ep7.el6.noarch.rpm

Red Hat JBoss Web Server 3.1 for RHEL 7:

Source:
tomcat7-7.0.70-41.ep7.el7.src.rpm
tomcat8-8.0.36-45.ep7.el7.src.rpm

noarch:
tomcat7-7.0.70-41.ep7.el7.noarch.rpm
tomcat7-admin-webapps-7.0.70-41.ep7.el7.noarch.rpm
tomcat7-docs-webapp-7.0.70-41.ep7.el7.noarch.rpm
tomcat7-el-2.2-api-7.0.70-41.ep7.el7.noarch.rpm
tomcat7-javadoc-7.0.70-41.ep7.el7.noarch.rpm
tomcat7-jsp-2.2-api-7.0.70-41.ep7.el7.noarch.rpm
tomcat7-jsvc-7.0.70-41.ep7.el7.noarch.rpm
tomcat7-lib-7.0.70-41.ep7.el7.noarch.rpm
tomcat7-log4j-7.0.70-41.ep7.el7.noarch.rpm
tomcat7-selinux-7.0.70-41.ep7.el7.noarch.rpm
tomcat7-servlet-3.0-api-7.0.70-41.ep7.el7.noarch.rpm
tomcat7-webapps-7.0.70-41.ep7.el7.noarch.rpm
tomcat8-8.0.36-45.ep7.el7.noarch.rpm
tomcat8-admin-webapps-8.0.36-45.ep7.el7.noarch.rpm
tomcat8-docs-webapp-8.0.36-45.ep7.el7.noarch.rpm
tomcat8-el-2.2-api-8.0.36-45.ep7.el7.noarch.rpm
tomcat8-javadoc-8.0.36-45.ep7.el7.noarch.rpm
tomcat8-jsp-2.3-api-8.0.36-45.ep7.el7.noarch.rpm
tomcat8-jsvc-8.0.36-45.ep7.el7.noarch.rpm
tomcat8-lib-8.0.36-45.ep7.el7.noarch.rpm
tomcat8-log4j-8.0.36-45.ep7.el7.noarch.rpm
tomcat8-selinux-8.0.36-45.ep7.el7.noarch.rpm
tomcat8-servlet-3.1-api-8.0.36-45.ep7.el7.noarch.rpm
tomcat8-webapps-8.0.36-45.ep7.el7.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2020-1935
https://access.redhat.com/security/cve/CVE-2020-13935
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXylDg9zjgjWX9erEAQj06g//ZTPPtFSotn5xsi2mDSvauOoiItVoLgyF
2nFB89pJmDjzOA1nxAki5/MSBW3DPsNCjMq8EVB94jz7vyuxnIopTzBese4tC6QQ
GsNfRmn3visxaREWTUQquov3B7nV7+uI3Mun9u0rxxYAe8D5fy8KU/ZZqnzCKmp+
04cFV18KQdXnPABu9iZPx13Yfk+x0Qf9SQYiOCbQyVuPpFQXYjdJhgFPQeY0GYLO
qTKEac5UEeuMR0KZ2PwisWNwe2n8G+f4tn6uLpr26jrzsEhz/RaZK9UGE6E61ts5
b8I9eF3nmsITMiGxBsVewgiAUFRu32veaxgKYx+D/7uHZuNBBEII2sscA5jAzxnk
bVqVwfivWsxxgctD4LnETGrWay4FzjXuL6yxwg2sfHH1VnxlhL1V1nSrnB6M+/vY
VRchvqGvYHcP9dS3dhenZZTfyilyGxjBGGF1NsyUpuUo9GlgBo0MFfEM7vHp7DET
fjklQj9fSYyWGXqfl+qdvgF9pN9kYJb65GCA4k+zN7GeAteK0dfBlXbsnJ4u9b6X
JIDZVg5iCiAEJ3RUTFIHRTt6LK1RBTllbiHDPauic9Sb68rHNEQoIp2ero6/65vP
IFqnjz+4vOcLVrkTpjWsNWixlTndaiDH1XLdtENz+vxdfnNmZD5VSblNJ/ScViE6
ottW4YHIE0k=NNXu
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2020-3303:01 Important: Red Hat JBoss Web Server 3.1 Service

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and RHEL 7

Summary

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 3.1 Service Pack 10 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS (CVE-2020-13935) * tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling (CVE-2020-1935)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Summary


Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2020-1935 https://access.redhat.com/security/cve/CVE-2020-13935 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat JBoss Web Server 3.1 for RHEL 6:
Source: tomcat7-7.0.70-41.ep7.el6.src.rpm tomcat8-8.0.36-45.ep7.el6.src.rpm
noarch: tomcat7-7.0.70-41.ep7.el6.noarch.rpm tomcat7-admin-webapps-7.0.70-41.ep7.el6.noarch.rpm tomcat7-docs-webapp-7.0.70-41.ep7.el6.noarch.rpm tomcat7-el-2.2-api-7.0.70-41.ep7.el6.noarch.rpm tomcat7-javadoc-7.0.70-41.ep7.el6.noarch.rpm tomcat7-jsp-2.2-api-7.0.70-41.ep7.el6.noarch.rpm tomcat7-jsvc-7.0.70-41.ep7.el6.noarch.rpm tomcat7-lib-7.0.70-41.ep7.el6.noarch.rpm tomcat7-log4j-7.0.70-41.ep7.el6.noarch.rpm tomcat7-selinux-7.0.70-41.ep7.el6.noarch.rpm tomcat7-servlet-3.0-api-7.0.70-41.ep7.el6.noarch.rpm tomcat7-webapps-7.0.70-41.ep7.el6.noarch.rpm tomcat8-8.0.36-45.ep7.el6.noarch.rpm tomcat8-admin-webapps-8.0.36-45.ep7.el6.noarch.rpm tomcat8-docs-webapp-8.0.36-45.ep7.el6.noarch.rpm tomcat8-el-2.2-api-8.0.36-45.ep7.el6.noarch.rpm tomcat8-javadoc-8.0.36-45.ep7.el6.noarch.rpm tomcat8-jsp-2.3-api-8.0.36-45.ep7.el6.noarch.rpm tomcat8-jsvc-8.0.36-45.ep7.el6.noarch.rpm tomcat8-lib-8.0.36-45.ep7.el6.noarch.rpm tomcat8-log4j-8.0.36-45.ep7.el6.noarch.rpm tomcat8-selinux-8.0.36-45.ep7.el6.noarch.rpm tomcat8-servlet-3.1-api-8.0.36-45.ep7.el6.noarch.rpm tomcat8-webapps-8.0.36-45.ep7.el6.noarch.rpm
Red Hat JBoss Web Server 3.1 for RHEL 7:
Source: tomcat7-7.0.70-41.ep7.el7.src.rpm tomcat8-8.0.36-45.ep7.el7.src.rpm
noarch: tomcat7-7.0.70-41.ep7.el7.noarch.rpm tomcat7-admin-webapps-7.0.70-41.ep7.el7.noarch.rpm tomcat7-docs-webapp-7.0.70-41.ep7.el7.noarch.rpm tomcat7-el-2.2-api-7.0.70-41.ep7.el7.noarch.rpm tomcat7-javadoc-7.0.70-41.ep7.el7.noarch.rpm tomcat7-jsp-2.2-api-7.0.70-41.ep7.el7.noarch.rpm tomcat7-jsvc-7.0.70-41.ep7.el7.noarch.rpm tomcat7-lib-7.0.70-41.ep7.el7.noarch.rpm tomcat7-log4j-7.0.70-41.ep7.el7.noarch.rpm tomcat7-selinux-7.0.70-41.ep7.el7.noarch.rpm tomcat7-servlet-3.0-api-7.0.70-41.ep7.el7.noarch.rpm tomcat7-webapps-7.0.70-41.ep7.el7.noarch.rpm tomcat8-8.0.36-45.ep7.el7.noarch.rpm tomcat8-admin-webapps-8.0.36-45.ep7.el7.noarch.rpm tomcat8-docs-webapp-8.0.36-45.ep7.el7.noarch.rpm tomcat8-el-2.2-api-8.0.36-45.ep7.el7.noarch.rpm tomcat8-javadoc-8.0.36-45.ep7.el7.noarch.rpm tomcat8-jsp-2.3-api-8.0.36-45.ep7.el7.noarch.rpm tomcat8-jsvc-8.0.36-45.ep7.el7.noarch.rpm tomcat8-lib-8.0.36-45.ep7.el7.noarch.rpm tomcat8-log4j-8.0.36-45.ep7.el7.noarch.rpm tomcat8-selinux-8.0.36-45.ep7.el7.noarch.rpm tomcat8-servlet-3.1-api-8.0.36-45.ep7.el7.noarch.rpm tomcat8-webapps-8.0.36-45.ep7.el7.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
Advisory ID: RHSA-2020:3303-01
Product: Red Hat JBoss Web Server
Advisory URL: https://access.redhat.com/errata/RHSA-2020:3303
Issued Date: : 2020-08-04
CVE Names: CVE-2020-1935 CVE-2020-13935

Topic

An update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 andRHEL 7.Red Hat Product Security has rated this release as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.


Topic


 

Relevant Releases Architectures

Red Hat JBoss Web Server 3.1 for RHEL 6 - noarch

Red Hat JBoss Web Server 3.1 for RHEL 7 - noarch


Bugs Fixed

1806835 - CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling

1857024 - CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


Related News

CISA Sounds Alarm on Newly Exploited Vulnerabilities: Is Your System at Risk?
3 - 5 min read
CISA regularly publishes updates regarding vulnerabilities that present severe threats to global cybersecurity. Recently, CISA added three
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered
Open Source Strategies for Enhancing Security in Digital Business Operations
5 - 9 min read
Digital transformation, powered by the principles of open-source security , is vital for businesses looking to excel in today's technology-driven

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved